Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 09:49
Behavioral task
behavioral1
Sample
DVR_Universal_Memory_Patcher_V1.2_panospc/intl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
DVR_Universal_Memory_Patcher_V1.2_panospc/intl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
DVR_Universal_Memory_Patcher_V1.2_panospc/intl_original.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
DVR_Universal_Memory_Patcher_V1.2_panospc/intl_original.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Emulator DVREMU2 Manager 1.0.1 R2R/Setup DVREMU2 Manager v1.0.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target Emulator DVREMU2 Manager 1.0.1 R2R/Setup DVREMU2 Manager v1.0.1.exe
- Size 9.3MB
- Sample260815-ltrjfstdmd
- SHA256 9cb27edd48736aaba2e7f2f9b1761a378ebe9ae475ad12ce2858c52752bd0f0f
- MD5 eb96b7415a6fa7a46d46131264be9ca0
- SHA1 1e54a54f110208b963a477af2de6680d299438da
- SHA512 67a632ca86d788268075875cb7153dded161b0832d89c438ade4d199a2313627988324b6a14bff085fc9675b8e2cf9e8f4d678b7187df4dc2b12d8a992ee059d
- SSDEEP 196608:YY62K+7jJa3qhCgTp38kfCHM1CPwDvt3uFv1Ca9K845scJ0IuX:YYXK+7jJa3QCgTp38kqHM1CPwDvt3uF/
- TLSH T154A6AE7EA2BC0109E4AB91BDC2935223DB71B91567B017CF59A495F80F37BE51A3E380
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation Setup DVREMU2 Manager v1.0.1.tmp Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation DVREMU2MAN.exe - Executes dropped EXE 6 IoCs
pid Process 4932 Setup DVREMU2 Manager v1.0.1.tmp 4560 DVREMU2MAN.exe 3332 DVREMU2MAN.exe 692 DVREMU2MAN.exe 4400 DVREMU2MAN.exe 1724 DVREMU2MAN.exe - Loads dropped DLL 10 IoCs
pid Process 4560 DVREMU2MAN.exe 4560 DVREMU2MAN.exe 3332 DVREMU2MAN.exe 3332 DVREMU2MAN.exe 692 DVREMU2MAN.exe 692 DVREMU2MAN.exe 4400 DVREMU2MAN.exe 4400 DVREMU2MAN.exe 1724 DVREMU2MAN.exe 1724 DVREMU2MAN.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\TEAM R2R\DVREMU2 Manager\unins000.dat Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\is-KBKOAWPC25.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\is-SH1RZEI7RM.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\is-LDMOJA4PHE.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\is-USNNBSHDGT.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\is-VCCI8UG4Z3.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\is-KYJ5DJWMLS.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\is-QLUK2R83K1.tmp Setup DVREMU2 Manager v1.0.1.tmp File opened for modification C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe Setup DVREMU2 Manager v1.0.1.tmp File opened for modification C:\Program Files\TEAM R2R\DVREMU2 Manager\libbz2.dll Setup DVREMU2 Manager v1.0.1.tmp File opened for modification C:\Program Files\TEAM R2R\DVREMU2 Manager\libcrypto-4-x64.dll Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\is-S4LV53XBKQ.tmp Setup DVREMU2 Manager v1.0.1.tmp File created C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\is-K5AT1EICN5.tmp Setup DVREMU2 Manager v1.0.1.tmp File opened for modification C:\Program Files\TEAM R2R\DVREMU2 Manager\unins000.dat Setup DVREMU2 Manager v1.0.1.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4720 cmd.exe 4644 cmd.exe 4988 cmd.exe 4488 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup DVREMU2 Manager v1.0.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup DVREMU2 Manager v1.0.1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral5/memory/1704-1-0x0000000000820000-0x0000000000916000-memory.dmp innosetup behavioral5/memory/1704-7-0x0000000000820000-0x0000000000916000-memory.dmp innosetup behavioral5/memory/1704-46-0x0000000000820000-0x0000000000916000-memory.dmp innosetup -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a003100000000000f5d4e4e10005445414d52327e310000420009000400efbe0f5d4e4e0f5d4f4e2e000000df440200000007000000000000000000000000000000483b2d005400450041004d002000520032005200000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 68003100000000000f5d4f4e1000445652454d557e310000500009000400efbe0f5d4e4e0f5d524e2e000000e044020000000700000000000000000000000000000009ce220144005600520045004d005500320020004d0061006e006100670065007200000018000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).x = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).y = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).left = "200" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).top = "484" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).x = "4294967295" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000000f5d4e4e110050524f4752417e310000740009000400efbe874fdb490f5d4f4e2e0000003f0000000000010000000000000000004a0000000000483b2d00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).right = "1339" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).bottom = "1125" explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings Setup DVREMU2 Manager v1.0.1.tmp Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).y = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5a003100000000000f5d4f4e1000636f6d6d616e64730000420009000400efbe0f5d4f4e0f5d4f4e2e000000e7440200000007000000000000000000000000000000346c200163006f006d006d0061006e0064007300000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3180 explorer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4932 Setup DVREMU2 Manager v1.0.1.tmp 4932 Setup DVREMU2 Manager v1.0.1.tmp - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3180 explorer.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4932 Setup DVREMU2 Manager v1.0.1.tmp 4812 NOTEPAD.EXE 3180 explorer.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4932 Setup DVREMU2 Manager v1.0.1.tmp 4560 DVREMU2MAN.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1704 wrote to memory of 4932 1704 Setup DVREMU2 Manager v1.0.1.exe 86 PID 4932 wrote to memory of 4812 4932 Setup DVREMU2 Manager v1.0.1.tmp 96 PID 4560 wrote to memory of 2228 4560 DVREMU2MAN.exe 101 PID 3180 wrote to memory of 4720 3180 explorer.exe 104 PID 4720 wrote to memory of 3332 4720 cmd.exe 106 PID 3180 wrote to memory of 4644 3180 explorer.exe 107 PID 4644 wrote to memory of 692 4644 cmd.exe 109 PID 3180 wrote to memory of 4988 3180 explorer.exe 110 PID 4988 wrote to memory of 4400 4988 cmd.exe 112 PID 3180 wrote to memory of 4488 3180 explorer.exe 113 PID 4488 wrote to memory of 1724 4488 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\Emulator DVREMU2 Manager 1.0.1 R2R\Setup DVREMU2 Manager v1.0.1.exe"C:\Users\Admin\AppData\Local\Temp\Emulator DVREMU2 Manager 1.0.1 R2R\Setup DVREMU2 Manager v1.0.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\is-OPCVUSEFTU.tmp\Setup DVREMU2 Manager v1.0.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-OPCVUSEFTU.tmp\Setup DVREMU2 Manager v1.0.1.tmp" /SL5="$110044,8262918,950272,C:\Users\Admin\AppData\Local\Temp\Emulator DVREMU2 Manager 1.0.1 R2R\Setup DVREMU2 Manager v1.0.1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\TEAM R2R\DVREMU2 Manager\Readme.txt3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4812
-
-
-
C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe"C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\2⤵PID:2228
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Install Emulator.cmd"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe..\\DVREMU2MAN install3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Renew Emulator License.cmd" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe..\\DVREMU2MAN renew3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Install Emulator.cmd" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe..\\DVREMU2MAN install3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Test License and Emulator.cmd" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe..\\DVREMU2MAN test3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\DVREMU2MAN.exe
- Size 102KB
- SHA256 90f900235485cf27acd95ee176c2a152765dea349962910a8e614de33289a964
- MD5 e8affab9cb0095e45bd2636305eab36f
- SHA1 96c95c5ddc87f767886ad81f0f582deca18590e4
- SHA512 2090a0254f09e4d56076a5fc6c9084aad1450688c5cc68c34fe62ad6ade44584f99630640763dbf404f73a2242973ee80f1dc08defa16bd52ed93f8515833450
- SSDEEP 1536:ELe4pNI8Y+BxsY3cBOtlRYE3wD06YUCfyJwH8Aa5vCWVpqTet2YVFfcQB:GtvI8/BxsYftl3L6YcJwHpa8WXqEZ
- TLSH T1AEA3E08B8B50CAF9F5B0813B15E2463EF265B0C547514BCF39F689481E29BC1FA7A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\Readme.txt
- Size 2KB
- SHA256 57ba10d6b3c93963a34708cf2d8edfe8b2651637f794c8951687f071ef2a16c8
- MD5 e90cb01819e9a2fa4736bf4edf080ec8
- SHA1 bcf3f910840d8f1a6fe2a5a37020ec95f2abdbe2
- SHA512 7c60f98f710ac0b9210b429e0a03ef16d6e6bc67707cdd1ec6627ee9b6f206ae4cf440560ac1fd14ef4c90da52cfe83b84b56973f7717b1374b3dc4ec2259e4d
- TLSH T1C651219F6EB9D33A1D61F38F944FA5A5E348D499837E201278DF4408320A4A3036E5F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Install Emulator.cmd
- Size 22B
- SHA256 9c5465254c6ecc96177657bc039f33eef1b8f99f6349187566e6e4d1f5cd0c89
- MD5 74d85c83cdbe109e9972b8db37e30492
- SHA1 ac1e0fc13472c74dc11f394e87ec71645fec849d
- SHA512 0ae790756f03e1cb2d66493f451fc7c4500f9fb181f30596b4c96a1ff2d9be44437c42ffc79d4709b6c7677e10813f55ec4b303eecd2b006abc0b4629c998cd8
- MD5 SHA1 SHA512
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Renew Emulator License.cmd
- Size 20B
- SHA256 d941aaf2e03be3eab4670f34e0de05bcdfbe622674779a093a91ca500e98ce71
- MD5 cd55db859b9c6f1811d72ac4dd793356
- SHA1 c45bd9d9319192f80a1975b21c4b974a5602d926
- SHA512 a55528c377d02c0959a2cc35a64d167318c9160ed2ed042d14ddc3990883bb73df4214f6f52aeb30418d5034aef4daaa3bbc54d5960cc237d70ca6636851e5a2
- MD5 SHA1 SHA512
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\commands\DVREMU2 - Test License and Emulator.cmd
- Size 19B
- SHA256 4514aa7e9b6114da0a3b0b985a9107f5184de99f9f822ff13d2204263c373b0e
- MD5 509354ede1a8e4dc9387f8f1d2cb874f
- SHA1 8dff15d78bb16741dcc873633ab19cd9f4ba6fd0
- SHA512 f68430b69d4f60c4e6125d60324438674051fdd75fd1c5b61edc0aab59df08f8ca261611d3939adf454267c6d829c9fe49b0e91a7e68eb6d23ba4739c9d628e3
- MD5 SHA1 SHA512
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\libbz2.dll
- Size 69KB
- SHA256 57d9cb6e10ba90a3b8e9c2b2eab2b80937b088123adb482eab71ef550cce7794
- MD5 b6c39ab833a3bc29183d0633bb9421ab
- SHA1 304a8ae9e4668625571301acfa9e14c7a89a469c
- SHA512 f5fcc0e9a92499b316ce8b65e583a9329e519a61c87d482283305ce1db88d6a109197c427e431bf39dfcba8e30181937300da15b287f5e663e7807d999a6fdc8
- SSDEEP 768:YOK4+beCw4Iuc9QfwE/JE16O2RQg/Nr0t9PdFmphy5rn2g6///////5iHFN23AGI:g4+yCNIuT7SN2RhCtrouBHX82p
- TLSH T184634C82D7A26FAFC45342B9A206D90FE3727CA803717ACB4260F63D1741BF52579786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TEAM R2R\DVREMU2 Manager\libcrypto-4-x64.dll
- Size 6.8MB
- SHA256 2293979c545c2e798e141e2c13f1107687a15c590fa428976ea11a38f462c720
- MD5 78d8a5fd222b13150419e49877623a3b
- SHA1 3adb4f03f732e568fb767fcfe2bef0f549109572
- SHA512 a088d8e2a3f74aa8120c3ebbcc62f2468a839f082e44c26c409eb450b7e54bdbad3fc90d65bbb75a632efa110e567019b9c547340f7df2c796eafb8e9f70a4f9
- SSDEEP 196608:9K+7jJa3qhCgTp38kfCHM1CPwDvt3uFv1Ca:9K+7jJa3QCgTp38kqHM1CPwDvt3uFdCa
- TLSH T144767C6DA6BC0105E4ABC0BDC2975327DB71B91967B013CF596186F80F27BD92A7E380
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OPCVUSEFTU.tmp\Setup DVREMU2 Manager v1.0.1.tmp
- Size 4.9MB
- SHA256 45527bd58f5908841d7fde97b0fe008d849fb46a188ab17c5e88588a249d6093
- MD5 ae533ce3f7b9e1faf12097179e15ef77
- SHA1 907a8a91194b675258be33190361743002b16809
- SHA512 98c4bb7bab0f2dae692fd9e80e0c6106ecfc4fbded9373b20a732e56e5f276c312ec491ad6fd72a15cac208376e649311c242b97433d4aa52f6d908bb1873aa3
- SSDEEP 98304:2vdHRh7Vhv2Wn+FYGa7xP2gRQJhpmo333p333Me:kHLn+eHNt0Ge
- TLSH T1C1368E23F384A53ED4671B3A687BA658583F7A303A158C476BFC395C4E396402D3A787
- MD5 SHA1 SHA512 SSDEEP TLSH